The attacker behind the KelpDAO exploit converted roughly 75,700 ETH, worth about $175 million, into Bitcoin within 36 hours. The swaps were routed almost entirely through THORChain, a cross-chain protocol built for direct swaps between networks without intermediaries. The pace and scale of the conversion turned a routine-looking laundering operation into one of the largest cross-chain money movements of the year.
How THORChain Became the Exit Route
THORChain handled the bulk of the ETH-to-BTC conversions. The size of the transactions pushed roughly $800 million in trading volume through the protocol and generated around $910,000 in fees during the laundering window. Almost every remaining ETH holding in the attacker’s wallet was converted during that 36-hour run.
Cross-chain protocols are attractive to attackers for the same reason they are useful to legitimate users. Swaps settle on the destination chain without a single custodian holding both legs of the trade, which removes any centralized party that could block the conversion. Once ETH becomes BTC, the tracing problem changes shape: each chain has its own forensic tools, and the stolen value now lives on a network where the original DeFi recovery mechanisms no longer apply.
Timeline of the Exploit and the Response
The laundering run did not happen in isolation. It was the final stage of a multi-day incident that began on April 18 and has already triggered one of the largest DeFi capital exits on record.
| Event | Details |
|---|---|
| April 18: Initial exploit | 116,500 rsETH drained from KelpDAO, valued between $290M and $293M |
| April 21: Arbitrum freeze | Security Council isolates 30,766 ETH on Arbitrum, coordinates with law enforcement |
| April 21 to 23: Laundering run | 75,700 ETH worth $175M converted to Bitcoin through THORChain in 36 hours |
| Sector-wide fallout | Roughly $15 billion withdrawn from DeFi platforms following the exploit |
Arbitrum’s Emergency Freeze
Before the main conversion activity, a portion of the stolen assets had been moved onto Arbitrum. The Arbitrum Security Council implemented emergency measures to secure 30,766 ETH tied to the exploit, transferring the funds to a specific network-controlled address. The action made the balance inaccessible to the attacker without further governance intervention.
The Security Council said it acted with input from law enforcement regarding the exploiter’s identity. The technical steps were designed to isolate the funds without disrupting other users or applications on the network. The frozen ETH now sits under Arbitrum governance, with any future movement requiring a formal council decision.
The freeze covers only a fraction of the total loss. Once the attacker lost access to the Arbitrum-based funds, they continued moving ETH from the Ethereum network itself, routing some smaller transactions through privacy tools including UmbraCash before the bulk conversion to Bitcoin began.
Broader Fallout Across DeFi
The original exploit, on April 18, drained 116,500 rsETH from KelpDAO, with a total value estimated between $290 million and $293 million. It ranks as one of the largest DeFi losses recorded in 2026. The aftermath has been even more expensive than the exploit itself: roughly $15 billion in deposits left DeFi platforms in the days that followed as users repriced counterparty risk across the sector.
Separate reporting indicates that attackers linked to North Korea stole close to $600 million from on-chain applications in the first quarter alone, with the KelpDAO incident adding to a series of high-value breaches during the period. The Kelp laundering run is the latest example of how quickly large volumes of stolen on-chain assets can be restructured across networks when cross-chain liquidity is available and governance response windows are measured in days rather than hours.
